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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)^ Responsive to communication(s) filed on 13 March 2006 , 
2a)D This action is FINAL. 2b)[>3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-51 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 1-47,50 and 51 is/are rejected. 

7) ^ Claim(sV 48 and 49 is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) 13 The drawing(s) filed on 13 March 2006 is/are: a)E3 accepted or b)Q objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) ^ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5 ) D Notice of Informal Patent Application (PTO-152) 

Paper No(s)/Mail Date . 6) □ Other: . 
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DETAILED ACTION 

1 . Claims 1 -5 1 are pending. 

Terminal Disclaimer 

2. The terminal disclaimer filed on March 13, 2006 disclaiming the terminal portion of any 
patent granted on this application which would extend beyond the expiration date of any patent 
granted on Application Number 09/881,058 has been reviewed and is accepted. The terminal 
disclaimer has been recorded. 

Response to Arguments 

3. Applicant's arguments with respect to claims 1-51 have been considered but are moot in 
view of the new ground(s) of rejection. 

Drawings 

4. The drawings were received on March 13, 2006. These drawings are acceptable. 

Claim Rejections - 35 USC § 112 

The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

5. Claims 2-12, 14, 15, 17-27, 29, 30, 32-42 and 44-51 rejected under 35 U.S.C. 112, 
second paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 
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As per claims 2-12, 14, 15, 17-27, 29, 30, 32-42 and 44-51: 

The use of the wherein clause denotes function that further limits the scope of the claim. 
If used in an apparatus claim, the wherein clause should further limit the structure of the 
apparatus and if used in a method claim the claim must clearly and explicitly describe the active 
steps needed in order to achieve the desired result (See MPEP 2111 .04). For example, the 
apparatus claim 33 states, "wherein said computer file contains one or more embedded computer 
files. . ." which is merely remarking on a characteristic of the computer file and not further 
limiting the structure of the apparatus. In addition, the method claim 19 merely states, "wherein 
said computer file is one of the following computer file types. . ." which, again, is a recitation of a 
desired characteristic of the computer file and is not a desired result with explicit steps as to how 
to obtain the desired result. Finally, claim 5 also utilizes the wherein clause with an intended use 
which is, "for identifying different properties of said computer file. . ." but the claim does not 
explain how this is accomplished. 

Therefore, the wherein clauses used in every dependent claim fail to distinguish new 
limiting features from the independent claims and seem to merely remark on various 
characteristics of the present invention and if this is the case then no patentable weight will be 
given. The word further could be added in some instances, such as claim 35, with the addition 
clearly spelled. For example, claim 35 would read, "wherein said scan divider further divides 
said on-access malware. . .", otherwise it is not clear whether applicant is simply remarking on a 
characteristic of the scan divider or if it is a further limitation, in addition to the function it is 
given in independent claim 3 1 . 
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As per claim 8: 

The word "liner" is used in line 2 and it is not clear what "liner" means, therefore, 
appropriate correction is required. 

Claim Rejections - 35 USC § 102 
The text of those sections of Title 35, U.S. Code not included in this action can be found 
in a prior Office action. 

6. Claims 1, 5-8, 12, 13, 15, 16, 20-23, 27, 28, 31, 35-38, 42, 43 and 50-51 rejected under 
35 U.S.C. 102(e) as being anticipated by Gryaznov et al. (Gryaznov), U.S. Patent No. 6,748,534. 

As per claims 1,7, 13, 16, 22, 28, 31, 37 and 43: 

Gryaznov discloses a computer program product comprising: 

A plurality of files, scan initiating logic, scan dividing logic, task issuing logic, task result 
logic and scan merging logic (abs., figs. 3-4c, 2:43-67, cols. 5-6, 7:1-42). Specific characteristics 
such as a worm or Trojan computer program (cols. 5-7). The scan is divided into multiple virus 
scans which constitutes dividing the scan into a plurality of tasks since multiple individual scans 
are tasks. The result from the tasks or multiple scans are collated in the sense that they are 
assembled together sequentially in the loop. 

As per claims 5, 15, 20 and 35: 

Gryaznov discloses a computer program product wherein the scan dividing logic divides 
the scan into a plurality of scans for identifying different properties of a computer file, said 
plurality of scans being separately performed as said plurality of tasks (6:1-13, wherein, the virus 
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scanners are identifying properties of a computer file since they are identifying viruses which are 
properties of the computer file that they are infecting). 
As per claims 8, 23 and 38: 

Gryaznov discloses a computer program product wherein the one or more tasks are 
further divided into sub-tasks (5:46-67, fig. 4a-4c, wherein the sequence of process steps are the 
tasks, which are the multiple virus scans into sub-tasks which are the processing steps that each 
virus scan is broken down into). 

As per claims 12, 27, 42 and 50: 

Gryaznov discloses a computer program product wherein the result collating logic 
terminates any outstanding tasks if a task result is received indicating detection of malware 
within said computer file (7:36-45). 

As per claim 51: 

Gryaznov discloses a computer program product wherein said plurality of tasks are 
distributed among said plurality of different computers via network (6:1-13). 

Claim Rejections - 35 USC § 103 

7. Claims 2-4, 9-11, 14, 17-19, 24-26, 29, 32-34, 39-41, 44 and 46-47 rejected under 35 
U.S.C. 103(a) as being unpatentable over Gryaznov (U.S. 6,748,534) as applied to claims 1, 7, 
13,16, 22, 28, 31, 37 and 43 above, and further in view of Gartside, U.S. Patent No. 6,851,058. 
As per claims 2-4, 14, 17-19, 29, 32-34 and 44: 

Gryaznov fails to teach computer files being divided into component files that contain 
embedded computer files to also be component computer files wherein the computer file is one 
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of a given list of types. However, Gartside discloses a method wherein a computer file is an 
archive file and the archive file is broken down into its component files which are further broken 
down if embedded files exist in order to be scanned (3:36-50 wherein the files are extracted from 
the archive and are thus divided out from the file and if one of the files is thus embedded and is 
an archive, it is extracted for scan, therefore the computer file is divided into component 
computer files to be separately scanned, 4:39-48, 1:53-63). 
As per claims 9-11, 24-26 and 39-41 and 46-47: 

Gryaznov fails to teach where a task is selected to be issued to another computer in 
dependence upon one of a variety of reasons and the scan dividing logic does not divide the scan 
if the scan is detected as having a complexity below a predetermined threshold level and where 
the complexity is determined as a function of one or more of a list. However, Gartside discloses 
an archive file not being divided if it is below a certain complexity level (6:1 7-65) wherein the 
complexity level is determined as a function of the archive file (6:17-65), and a scan being 
selected to happen depends upon the storage space available (4:61-5:6). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to combine the distributed scanning invention of Gryaznov with the archive scanning 
of Gartside because if the news database contained files with embedded files they could utilize a 
severe amount of processing power and memory space in order to scan through all of them 
(Gartside, 1 :64-2:6). Therefore, the division of the embedded archive files would allow the news 
database to provide the processing and bandwidth throughput required by a growing dataset 
(Gryaznov, 2:33-40). 
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8. Claims 6, 21 and 36 rejected under 35 U.S.C. 103(a) as being unpatentable over 
Gryaznov as applied to claims 1 and 5 above, and further in view of Ranger et al. (Ranger), U.S. 
Patent No. 6,393,568. 

As per claims 6, 21 and 36: 

Gryaznov fails to teach the plurality of tasks seeking to identify different portion of one 
of a cryptographic analysis and an emulation analysis. However, Ranger discloses a method 
wherein a virus scans employs a cryptographic analysis in order to determine whether any 
unsolicited content is present within an encrypted file (2:25-46). 

It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to utilize the invention of Ranger in combination with the invention of Gryaznov in 
order to detect viruses in encrypted news threads and thus increase the ability of the virus 
scanners to locate computer viruses in not only embedded computer files but also encrypted 
ones. 

Allowable Subject Matter 

9. Claims 48 and 49 objected to as being dependent upon a rejected base claim, but would 
be allowable if rewritten in independent form including all of the limitations of the base claim 
and any intervening claims. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kristin Derwich whose telephone number is 571-272-7958. The 
examiner can normally be reached on Monday - Friday, 8:00-5:30. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Kristin Derwich 
Examiner 
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GILBERTO BARRON ^ 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 




